Malicious Plugin
pidgin.im
Greetings everyone. It is with much regret that I am writing this post. A plugin, ss-otr, was added to the third party plugins list on July 6th. On August 16th we received a report from 0xFFFC0000 that the plugin contained a key logger and shared screen shots with unwanted parties. We quietly pulled the plugin from the list immediately and started investigating. On August 22nd Johnny Xmas was able to confirm that a keylogger was present.

Greetings everyone. It is with much regret that I am writing this post. A plugin, ss-otr, was added to the third party plugins list on July 6th. On August 16th we received a report from 0xFFFC0000 that the plugin contained a key logger and shared screen shots with unwanted parties.

We quietly pulled the plugin from the list immediately and started investigating. On August 22nd Johnny Xmas was able to confirm that a keylogger was present.

  • Telorand@reddthat.com
    89·
    4 months ago

    It went unnoticed at the time that the plugin was not providing any source code and was only providing binaries for download. Going forward, we will be requiring that all plugins that we link to have an OSI Approved Open Source License and that some level of due diligence has been done to verify that the plugin is safe for users.

    Unfortunate that this happened, but at least they are forcing more transparency to try to minimize the ability to hide behind opaque code.

    • __forward__@lemm.ee
      29·
      4 months ago

      Without some sort of reproducible builds (which are really finnickey to actually get) this doesn’t really help though. Adding some set of malicious patches before doing the binary release is trivial.

      • wizardbeard@lemmy.dbzer0.comEnglish
        16·
        4 months ago

        I agree that reproducible builds would be ideal and modifying binary releases is trivial, but any step forward is better than no review process at all.

        There’s no such thing as a perfect system. It’s all about increasing the number of hoops for an attacker to jump through. This is at least a step in the right direction.

      • cadekat@pawb.social
        7·
        4 months ago

        You don’t need reproducible builds. You can get by if you trust whoever compiled it, like your distro’s maintainers or the pidgin developers.

  • electricprism@lemmy.ml
    20·
    4 months ago

    I’m just surprised Pidgin hasn’t been rewritten from the ground up by now. Some of the available messengers and logos in the app don’t even exist anymore.

  • Churbleyimyam@lemm.ee
    19·
    4 months ago

    Was the plugin open source?

    Edit: looks like it wasn’t and the incident has prompted more more transparency. Good stuff.

    • sugartits@lemmy.world
      6·
      4 months ago

      Unless the pidgin team are compiling the binaries themselves, this doesn’t really fix much.

      Ideally we need reproducible builds.

      • delirious_owl
        1·
        4 months ago

        Its really not hard for them to compile themselves. This is what most package managers do

  • ExtremeDullard@lemmy.sdf.org
    18·
    4 months ago

    This danger is why I quit using the Purple Teams plugin for Pidgin: it works well enough (considering Teams isn’t exactly open to third-party clients, it works amazingly well in fact) it’s GPL-3.0, the source is provided and I compiled it.

    So I believe it’s clean, but that’s not good enough for me to hit our corporate Teams channels with it and I don’t have the time to audit the code. Not to mention, while my company trusts my good judgment, I’m pretty sure running an unauthorized client is against IT policies.

    So I dropped it, sadly. It’s a bummer because Pidgin uses a fraction of the resources needed by that pig of an Electron app - the official client - made by Microsoft.

    • folkrav@lemmy.ca
      61·
      4 months ago

      The newest Teams app (and I think newest Outlook amongst others) is using system/Edge provided WebViews rather than Electron, which I guess takes care of the “each app gets its own Chrome instance” part of the Electron bloat. It’s so far running better than old Teams for me. On my old work laptop, the fans spun up the second the old Teams client launched lol

  • Hello_there@fedia.io
    162·
    4 months ago

    This is still a thing? I used this in the age of AIM and didn’t know it stuck around past the shutdown

  • delirious_owl
    11·
    4 months ago

    I used to use pidgin for our corporate HipChat. Pidgin was the best client for HipChat. I especially liked the psychic plugin, so I could get notified as soon as someone began composing a message to me (well before they sent the message).

    I wrote a small python script to send my phone a high-priority message alert whenever my boss began composing a message to me. This was especially useful when I was in the kitchen or doing laundry or something.

    We lost so much when these shitty corporate messaging services went so far off the XMPP spec that we couldn’t use third party clients anymore

  • Churbleyimyam@lemm.ee
    10·
    4 months ago

    By the way; which messaging platforms, protocols or ‘services’ are currently supported by Pidgin? I haven’t looked at it in a while.

  • delirious_owl
    2·
    4 months ago

    To be fair, if your app has its own plugin list and installler, its probably going to be vulnerable to download malicious plugins.

    I don’t know of an in-app plugin installers that actually cryptographically verify signatures on downloads like apt does.